ConnectionS.zone

Scan Local Shares

#Globale Parameter
$PC=$env:COMPUTERNAME
$LogdateFormat = Get-Date -Format yyyy_MM_dd
$LogfilePath = "C:\___setup\" + $PC + "_" + $LogdateFormat + "_Suspicious_Shares.txt"
$Domain="Intranet"
$GroupPrefix="RSY"
$Global:PositiveMatch = @()

$EmailParameters = @{
    EmailFrom            = "notifications@company.com"
    EmailTo              = "someone@company.com"
    EmailCC              = ""
    EmailBCC             = ""
    EmailServer          = "10.1.2.90" 
    EmailServerPassword  = ""
    EmailServerPort      = "25"
    EmailServerLogin     = ""
    EmailServerEnableSSL = 0
    EmailEncoding        = "UTF8" 
    EmailSubject         = "&#91;Reporting] Auffällige Freigaben auf $PC gefunden"
    EmailPriority        = "Low" # Normal, High
}

$FormattingParameters = @{
    CompanyBranding   = @{
        Logo = "C:\___setup\Logo.png"
        Width = "250"
        Height = ""
        Link = "http://www.company.com"
    }     
    FontFamily        = "Calibri Light"
    FontSize          = "11pt"
    FontHeadingFamily = "Calibri Light"
    FontHeadingSize   = "14pt"
}

#Systemuser Sammlung
$SystemAdmins=@(
"NT SERVICE\TrustedInstaller",
"ERSTELLER-BESITZER",
"ZERTIFIZIERUNGSSTELLE FÜR ANWENDUNGSPAKETE\ALLE ANWENDUNGSPAKETE",
"ZERTIFIZIERUNGSSTELLE FÜR ANWENDUNGSPAKETE\ALLE EINGESCHRÄNKTEN ANWENDUNGSPAKETE",
"NT-AUTORITÄT\SYSTEM",
"VORDEFINIERT\Administrators",
"VORDEFINIERT\Administratoren"
)

$SystemUser=@(
"VORDEFINIERT\Users",
"VORDEFINIERT\Benutzer"
)


##############################
##############################
#      Function Library  
##############################
##############################

function Write-Color(&#91;String&#91;]]$Text, &#91;ConsoleColor&#91;]]$Color = "White", &#91;int]$StartTab = 0, &#91;int] $LinesBefore = 0,&#91;int] $LinesAfter = 0, &#91;string] $LogFile = "", $TimeFormat = "yyyy-MM-dd HH:mm:ss") {
    # version 0.2b
    # - added computername when logging to file
    # version 0.2
    # - added logging to file
    # version 0.1
    # - first draft
    # 
    # Notes:
    # - TimeFormat https://msdn.microsoft.com/en-us/library/8kb3ddd4.aspx

    $DefaultColor = $Color&#91;0]
    $Hostname = $env:COMPUTERNAME
    if ($LinesBefore -ne 0) {  for ($i = 0; $i -lt $LinesBefore; $i++) { Write-Host "`n" -NoNewline } } # Add empty line before
    if ($StartTab -ne 0) {  for ($i = 0; $i -lt $StartTab; $i++) { Write-Host "`t" -NoNewLine } }  # Add TABS before text
    if ($Color.Count -ge $Text.Count) {
        for ($i = 0; $i -lt $Text.Length; $i++) { Write-Host $Text&#91;$i] -ForegroundColor $Color&#91;$i] -NoNewLine } 
    } else {
        for ($i = 0; $i -lt $Color.Length ; $i++) { Write-Host $Text&#91;$i] -ForegroundColor $Color&#91;$i] -NoNewLine }
        for ($i = $Color.Length; $i -lt $Text.Length; $i++) { Write-Host $Text&#91;$i] -ForegroundColor $DefaultColor -NoNewLine }
    }
    Write-Host
    if ($LinesAfter -ne 0) {  for ($i = 0; $i -lt $LinesAfter; $i++) { Write-Host "`n" } }  # Add empty line after
    if ($LogFile -ne "") {
        $TextToFile = ""
        for ($i = 0; $i -lt $Text.Length; $i++) {
            $TextToFile += $Text&#91;$i]
        }
        if ($LinesBefore -ne 0) {  for ($i = 0; $i -lt $LinesBefore; $i++) { Write-output " " | Out-File $LogFile -Encoding unicode -Append } } # Add empty line before
        Write-Output "&#91;$Hostname] &#91;$(&#91;datetime]::Now.ToString($TimeFormat))] $TextToFile" | Out-File $LogFile -Encoding unicode -Append
        if ($LinesAfter -ne 0) {  for ($i = 0; $i -lt $LinesAfter; $i++) { Write-output " " | Out-File $LogFile -Encoding unicode -Append } } # Add empty line before
    }
}

Function Get-FolderACL{&#91;cmdletbinding()]

#.Synopsis
#    Lists Folder ACLs for a targeted directory
#.DESCRIPTION
#    Leverages the Get-ACL cmdlet's Access property to display the ACLs for a targeted directory in a list format.
#.EXAMPLE
#    Local or Mapped Drive: Get-FolderACL -Path C:\Scripts
#.EXAMPLE
#    Network Drive: Get-FolderACL -Path \\Server01\Share
#.NOTES
#    Created by Will Anderson - December 31, 2014
#    Version 1.1

    Param(
        &#91;Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True)]&#91;ValidateNotNullorEmpty()]&#91;string&#91;]]$Path
    )#EndParam
        BEGIN{Write-Verbose "Reading ACLs for $($MyInvocation.Mycommand)"
        }#BEGIN

        PROCESS{$Directory = Get-Acl -Path $Path
                    Try{
                        ForEach($Dir in $Directory.Access){
                            Write-Verbose "Reading Permissions for $($Dir.IdentityReference)"
                            &#91;PSCustomObject]@{
                                Path = $Path
                                Group = $Dir.IdentityReference
                                AccessType = $Dir.AccessControlType
                                Rights = $Dir.FileSystemRights
                                }
                        }#EndForEach
                    }#EndTry
                    Catch{
                          Write-Error $PSItem
                    }#EndCatch
         }#PROCESS
         
         END{Write-Verbose "Ending $($MyInvocation.Mycommand)"
         }#END

}#EndFunction


Function Check-Account () {
#Prüfung, ob der übergebene Account in der Systemusersammlung enthalten ist. 
param (
&#91;String]$ActualAccount, &#91;String&#91;]] $SystemAccounts
)

$myFound=$False

foreach ($Account in $SystemAccounts)
{
    $myFound=($myFound -or ($ActualAccount.Contains($Account)))

    if ($myFound) {Return $myFound}
}

Return $myFound
}


Function Check-FolderACL {&#91;cmdletbinding()]
# Prüfen, ob die NTFS-Berechtigungen in Ordnung sind
   Param(
        &#91;Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True)]&#91;ValidateNotNullorEmpty()]&#91;string&#91;]]$Path, &#91;string&#91;]] $Domain ="NESASP", &#91;string&#91;]] $GroupPrefix = "RSY"
    )#EndParam
        BEGIN{Write-Verbose "Checking ACLs for $($MyInvocation.Mycommand)"
        }#BEGIN

                PROCESS{
                    # NTFS-Berechtigungen für das Verzeichnis ermitteln
                    $FolderACL=Get-FolderACL -Path $Path
                    Try{
                        $MyCounter=0

                        # Jede einzelne Berechtigung überprüfen
                        foreach ($ACL in $FolderACL)
                        {
                            # Berechtigung in Variablen parken
                            $ACLAccount=$ACL.Group.ToString()
                            $ACLAccesstype=$ACL.AccessType
                            $ACLRights=$ACL.Rights
                            $ACLPath=$ACL.Path

                            # Prüfung, ob der aktuelle Account in den SystemUsern enthalten ist
                            $FoundUser=Check-Account -ActualAccount $ACLAccount -SystemAccounts $SystemUser
                            # Prüfung, ob der aktuelle Account in den SystemUsern oder in den SystemAdmins enthalten ist
                            $Found=((Check-Account -ActualAccount $ACLAccount -SystemAccounts $SystemAdmins) -or $FoundUser)


                            # Meldung ausgeben, wenn Vollzugriff erlaubt ist und (es ein Domänen-Account oder die Systemuser sind)
                            if (($ACLRights -eq "FullControl") -and ($ACLAccesstype -eq "Allow") -and (($ACLAccount.contains("$Domain")) -or $FoundUser)) {
                                write-color "Der Account ","$ACLAccount"," hat auf dem Pfad ",$ACLPath," Vollzugriff" -Color White,yellow,white,cyan,red -LogFile $LogfilePath
                                $MyCounter+=1
                                $Global:PositiveMatch+=$ACL | Select-Object @{Name='Freigabe';Expression={$Freigabe_Name}},
                                    @{Name='Pfad';Expression={$ACLPath}},
                                    @{Name='Account';Expression={$ACLAccount}},
                                    @{Name='Typ';Expression={"NTFS"}},
                                    @{Name='Zugriff';Expression={$ACLAccesstype}},
                                    @{Name='Rechte';Expression={$ACLRights}}
                            }
                            else {
                            # Meldung ausgeben, wenn der Account nicht zu den Systemaccounts oder zu den Standard-Ressourcengruppen der Domänen gehört
                            if (!($ACLAccount.Contains("$Domain\$GroupPrefix")) -and (!$Found)) {
                                write-color "Der Account ","$ACLAccount"," hat auf dem Pfad ",$ACLPath," spezielle Rechte: ","$ACLAccesstype/$ACLRights" -Color White,yellow,white,cyan,white,yellow -LogFile $LogfilePath
                                $MyCounter+=1
                                $Global:PositiveMatch+=$ACL | Select-Object @{Name='Freigabe';Expression={$Freigabe_Name}},
                                    @{Name='Pfad';Expression={$ACLPath}},
                                    @{Name='Account';Expression={$ACLAccount}},
                                    @{Name='Typ';Expression={"NTFS"}},
                                    @{Name='Zugriff';Expression={$ACLAccesstype}},
                                    @{Name='Rechte';Expression={$ACLRights}}
                            }
                        }
                        }
                        Return $MyCounter
                    }#EndTry

                        Catch{
                          Write-Error $PSItem
                    }#EndCatch
         }#PROCESS


         END{Write-Verbose "Ending $($MyInvocation.Mycommand)"
         }#END
}

function Set-EmailHead($FormattingOptions) {
    $Head = "&lt;style>" +
    "BODY{background-color:white;font-family:$($FormattingOptions.FontFamily);font-size:$($FormattingOptions.FontSize)}" +
    "TABLE{border-width: 1px;border-style: solid;border-color: black;border-collapse: collapse}" +
    "TH{border-width: 1px;padding: 3px;border-style: solid;border-color: black;background-color:`"#00297A`";font-color:white}" +
    "TD{border-width: 1px;padding-right: 2px;padding-left: 2px;padding-top: 0px;padding-bottom: 0px;border-style: solid;border-color: black;background-color:white}" +
    "H2{font-family:$($FormattingOptions.FontHeadingFamily);font-size:$($FormattingOptions.FontHeadingSize)}" +
    "P{font-family:$($FormattingOptions.FontFamily);font-size:$($FormattingOptions.FontSize)}" +
    "&lt;/style>"
    return $Head
}
function Set-EmailBody($TableData, $TableWelcomeMessage) {   
    $body = "&lt;p>&lt;i>$TableWelcomeMessage&lt;/i>" 
    if ($($TableData | Measure-Object).Count -gt 0) {                
        $body += $TableData | ConvertTo-Html | Out-String 
        $body = $body -replace "FullControl", "&lt;font color=`"red`">&lt;b>FullControl&lt;/b>&lt;/font>"
        $body = $body -replace "Full", "&lt;font color=`"red`">&lt;b>Full&lt;/b>&lt;/font>"
        $body = $body -replace "Jeder", "&lt;font color=`"red`">&lt;b>Jeder&lt;/b>&lt;/font>"
        $body = $body -replace "Everyone", "&lt;font color=`"red`">&lt;b>Everyone&lt;/b>&lt;/font>"
        $body += "&lt;/p>"
    }
    else {     
        $body += "&lt;br>&lt;i>No changes happend during that period.&lt;/i>&lt;/p>"
    }
    return $body
}
function Set-EmailReportBranding($FormattingOptions) {
    $Report = "&lt;a style=`"text-decoration:none`" href=`"$($FormattingOptions.CompanyBranding.Link)`" class=`"clink logo-container`">" +
    #"&lt;img width=171 height=15 src=`"$($FormattingOptions.CompanyLogo)`" border=`"0`" class=`"company-logo`" alt=`"company-logo`">" +
    "&lt;img width=&lt;fix> height=&lt;fix> src=`"$($FormattingOptions.CompanyBranding.Logo)`" border=`"0`" class=`"company-logo`" alt=`"company-logo`">" +
    "&lt;/a>"
    if ($FormattingOptions.CompanyBranding.Width -ne "") { 
        $report = $report -replace "width=&lt;fix>", "width=$($FormattingOptions.CompanyBranding.Width)" 
    }
    else { 
        $report = $report -replace "width=&lt;fix>", ""
    }
    if ($FormattingOptions.CompanyBranding.Height -ne "") { 
        $report = $report -replace "height=&lt;fix>", "height=$($FormattingOptions.CompanyBranding.Height)" 
    }
    else { 
        $report = $report -replace "height=&lt;fix>", ""
    }   
    return $Report
} 
function Set-EmailReportDetails($FormattingOptions) {
    $DateReport = get-date -Format "dd.MM.yyyy | hh:mm:ss"
    # HTML Report settings
    $Report = "&lt;p style=`"background-color:white;font-family:$($FormattingOptions.FontFamily);font-size:$($FormattingOptions.FontSize)`">" +
    "&lt;strong>Report Zeitpunkt:&lt;/strong> $DateReport Uhr&lt;br>" +
    "&lt;strong>Report ausgeführt von:&lt;/strong> $env:userdomain\$($env:username.toupper()) auf $($env:ComputerName.toUpper())" +
    "&lt;/p>"             
    return $Report
}


##############################
##############################
#       Main Procedure  
##############################
##############################

#Alle Userfreigaben einlesen und zählen     
$Ergebnis = Get-SMBshare | Where-Object {($_.Name -ne "C$") -and ($_.Name -ne "IPC$") -and ($_.Name -ne "ADMIN$") -and ($_.Name -ne "P$") }
$MaxCount= Measure-Object | %{$Ergebnis.Count}


# Gibt es keine Userfreigaben? Dann alles roger, ansonten im ELSE-Zweig abarbeiten
if ($MaxCount -eq 0) 
{
    Write-Color -Text "Keine Freigaben gefunden." -LogFile $LogfilePath -LinesBefore 1
}

else

{
    Write-Color -Text "Es wurden ","$MaxCount Freigaben"," auf dem Rechner $PC gefunden." -Color white,Yellow,White -LogFile $LogfilePath -LinesBefore 1

    # Gesamtzähler initialisieren    
    $TotalCounter=0


    # Durch die Freigaben iterieren
    foreach ($Freigabe in $Ergebnis) 
    {
        # Einzelzähler zurücksetzen und Infos zur Freigabe in Variablen parken
        $Counter=0
        $Freigabe_Name = $Freigabe.Name
        $SharePath = $Freigabe.Path
        write-color "Die Freigabe ","$Freigabe_Name"," unter Pfad ","$SharePath"," wird geprüft." -Color white,Magenta,white,cyan,white -LogFile $LogfilePath -LinesBefore 1
        $SMBAccounts = Get-SmbShareAccess -Name $Freigabe_Name

        # Dann in die Rechte der Freigabe eintauchen und diese einzeln durch gehen
        foreach ($SMBAccount in $SMBAccounts)
        {
            $Freigabe_Account = $SMBAccount.Accountname
            $Freigabe_Access =$SMBAccount.AccessRight
            $Freigabe_Accesstype = $SMBAccount.AccessControlType

            # Ist der Account NICHT innerhalb der Namenskonvention oder hat er Vollzugriff,
            # dann schlag Alarm
            # Namenskonvention: Der Account muss aus der vorgegebenen Domäne sein und der Account soll mit dem Standgruppepräfix beginnen
            # Beispiel: Domäne NESASP und es wird auf Standard-Ressourcengruppe geprüft, die mit RSY beginnen            
            if ((!($Freigabe_Account.contains("$Domain\$GroupPrefix")) -or ($Freigabe_Access -eq "Full")) ) {
                $Counter+=1
            
                # Vollzugriff separat melden
                if (($Freigabe_Access -eq "Full") -and ($Freigabe_Accesstype -eq "Allow")) {
                    Write-Color -Text "Der Account ","$Freigabe_Account"," hat auf der Freigabe ","$Freigabe_Name"," Vollzugriff" -Color white,Yellow,white,magenta,red -LogFile $LogfilePath
                    $PositiveMatch+=$SMBAccount | Select-Object @{Name='Freigabe';Expression={$Freigabe_Name}},
                                    @{Name='Pfad';Expression={$SharePath}},
                                    @{Name='Account';Expression={$Freigabe_Account}},
                                    @{Name='Typ';Expression={"SMB"}},
                                    @{Name='Zugriff';Expression={$Freigabe_Accesstype}},
                                    @{Name='Rechte';Expression={$Freigabe_Access}}
                }
                else {
                    Write-Color -Text "Der Account ","$Freigabe_Account"," hat auf der Freigabe ","$Freigabe_Name"," folgende Rechte: ","$Freigabe_Accesstype/$Freigabe_Access" -Color white,Yellow,white,magenta,white,yellow -LogFile $LogfilePath
                    $PositiveMatch+=$SMBAccount | Select-Object @{Name='Freigabe';Expression={$Freigabe_Name}},
                                    @{Name='Pfad';Expression={$SharePath}},
                                    @{Name='Account';Expression={$Freigabe_Account}},
                                    @{Name='Typ';Expression={"SMB"}},
                                    @{Name='Zugriff';Expression={$Freigabe_Accesstype}},
                                    @{Name='Rechte';Expression={$Freigabe_Access}}
                }
            }

        }

        # Handelt es sich um eine Dateifreigabe?
        # Dann prüfe die NTFS-Berechtigungen, ansonsten Info, das es sich um KEINE Dateifreigabe handelt
        if (($SharePath.Contains(":"))){
             $Counter+=Check-FolderACL -Path $SharePath -Domain $Domain -GroupPrefix $GroupPrefix
        }
        else {
             Write-Color "Der Pfad der Freigabe liegt nicht auf dem Dateisystem." -Color Yellow
        }
        
        
        # War bei dieser Freigabe alles in Ordnung? 
        if ($Counter -eq 0) {
                write-color "Auf Freigabe ","$Freigabe_Name"," ist alles in Ordnung." -Color Green,magenta,green -LogFile $LogfilePath 
        }

        # Gesamtzähler und Einzelzähler erhöhen
        $TotalCounter+=$Counter
    }


    # War insgesamt alles in Ordnung? 
    if ($TotalCounter -eq 0) {
        Write-Color -Text "Es wurden keine Auffälligkeiten gefunden!" -Color green -LogFile $LogfilePath
    }
    else {
        # Falls was gefunden wurde, dann Info und per Mail benachrichtigen
        Write-Color -Text "Es wurden ","$TotalCounter Auffälligkeiten ","gefunden!" -Color white,red,white -LogFile $LogfilePath -LinesBefore 1
        $EmailBody = Set-EmailHead  -FormattingOptions $FormattingParameters
        $EmailBody += Set-EmailReportBranding -FormattingOptions $FormattingParameters
        $EmailBody += Set-EmailReportDetails -FormattingOptions $FormattingParameters
        $EmailBody += Set-Emailbody -TableData $PositiveMatch -TableWelcomeMessage "Auffälligkeiten auf dem Server $PC"
        $Encoding=$EmailParameters.EmailEncoding
        
        Send-MailMessage -to $EmailParameters.EmailTo -Subject $EmailParameters.EmailSubject -From $EmailParameters.EmailFrom -Attachments "$LogfilePath" -Body $EmailBody -SmtpServer $EmailParameters.EmailServer -encoding (&#91;System.Text.Encoding]::$Encoding) -BodyAsHtml -Port $EmailParameters.EmailServerPort
    }
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

#Globale Parameter

$PC=$env:COMPUTERNAME

$LogdateFormat = Get-Date -Format yyyy_MM_dd

$LogfilePath = "C:\___setup\" + $PC + "_" + $LogdateFormat + "_Suspicious_Shares.txt"

$Domain="Intranet"

$GroupPrefix="RSY"

$Global:PositiveMatch = @()

$EmailParameters = @{

EmailFrom = "notifications@company.com"

EmailTo = "someone@company.com"

EmailCC = ""

EmailBCC = ""

EmailServer = "10.1.2.90"

EmailServerPassword = ""

EmailServerPort = "25"

EmailServerLogin = ""

EmailServerEnableSSL = 0

EmailEncoding = "UTF8"

EmailSubject = "[Reporting] Auffällige Freigaben auf $PC gefunden"

EmailPriority = "Low" # Normal, High

}

$FormattingParameters = @{

CompanyBranding = @{

Logo = "C:\___setup\Logo.png"

Width = "250"

Height = ""

Link = "http://www.company.com"

}

FontFamily = "Calibri Light"

FontSize = "11pt"

FontHeadingFamily = "Calibri Light"

FontHeadingSize = "14pt"

}

#Systemuser Sammlung

$SystemAdmins=@(

"NT SERVICE\TrustedInstaller",

"ERSTELLER-BESITZER",

"ZERTIFIZIERUNGSSTELLE FÜR ANWENDUNGSPAKETE\ALLE ANWENDUNGSPAKETE",

"ZERTIFIZIERUNGSSTELLE FÜR ANWENDUNGSPAKETE\ALLE EINGESCHRÄNKTEN ANWENDUNGSPAKETE",

"NT-AUTORITÄT\SYSTEM",

"VORDEFINIERT\Administrators",

"VORDEFINIERT\Administratoren"

)

$SystemUser=@(

"VORDEFINIERT\Users",

"VORDEFINIERT\Benutzer"

)

##############################

# Function Library

##############################

function Write-Color([String[]]$Text, [ConsoleColor[]]$Color = "White", [int]$StartTab = 0, [int] $LinesBefore = 0,[int] $LinesAfter = 0, [string] $LogFile = "", $TimeFormat = "yyyy-MM-dd HH:mm:ss") {

# version 0.2b

# - added computername when logging to file

# version 0.2

# - added logging to file

# version 0.1

# - first draft

# Notes:

# - TimeFormat https://msdn.microsoft.com/en-us/library/8kb3ddd4.aspx

$DefaultColor = $Color[0]

$Hostname = $env:COMPUTERNAME

if ($LinesBefore -ne 0) { for ($i = 0; $i -lt $LinesBefore; $i++) { Write-Host "`n" -NoNewline } } # Add empty line before

if ($StartTab -ne 0) { for ($i = 0; $i -lt $StartTab; $i++) { Write-Host "`t" -NoNewLine } } # Add TABS before text

if ($Color.Count -ge $Text.Count) {

for ($i = 0; $i -lt $Text.Length; $i++) { Write-Host $Text[$i] -ForegroundColor $Color[$i] -NoNewLine }

} else {

for ($i = 0; $i -lt $Color.Length ; $i++) { Write-Host $Text[$i] -ForegroundColor $Color[$i] -NoNewLine }

for ($i = $Color.Length; $i -lt $Text.Length; $i++) { Write-Host $Text[$i] -ForegroundColor $DefaultColor -NoNewLine }

}

Write-Host

if ($LinesAfter -ne 0) { for ($i = 0; $i -lt $LinesAfter; $i++) { Write-Host "`n" } } # Add empty line after

if ($LogFile -ne "") {

$TextToFile = ""

for ($i = 0; $i -lt $Text.Length; $i++) {

$TextToFile += $Text[$i]

}

if ($LinesBefore -ne 0) { for ($i = 0; $i -lt $LinesBefore; $i++) { Write-output " " | Out-File $LogFile -Encoding unicode -Append } } # Add empty line before

Write-Output "[$Hostname] [$([datetime]::Now.ToString($TimeFormat))] $TextToFile" | Out-File $LogFile -Encoding unicode -Append

if ($LinesAfter -ne 0) { for ($i = 0; $i -lt $LinesAfter; $i++) { Write-output " " | Out-File $LogFile -Encoding unicode -Append } } # Add empty line before

}

Function Get-FolderACL{[cmdletbinding()]

#.Synopsis

# Lists Folder ACLs for a targeted directory

#.DESCRIPTION

# Leverages the Get-ACL cmdlet's Access property to display the ACLs for a targeted directory in a list format.

#.EXAMPLE

# Local or Mapped Drive: Get-FolderACL -Path C:\Scripts

#.EXAMPLE

# Network Drive: Get-FolderACL -Path \\Server01\Share

#.NOTES

# Created by Will Anderson - December 31, 2014

# Version 1.1

Param(

[Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True)][ValidateNotNullorEmpty()][string[]]$Path

)#EndParam

BEGIN{Write-Verbose "Reading ACLs for $($MyInvocation.Mycommand)"

}#BEGIN

PROCESS{$Directory = Get-Acl -Path $Path

Try{

ForEach($Dir in $Directory.Access){

Write-Verbose "Reading Permissions for $($Dir.IdentityReference)"

[PSCustomObject]@{

Path = $Path

Group = $Dir.IdentityReference

AccessType = $Dir.AccessControlType

Rights = $Dir.FileSystemRights

}

}#EndForEach

}#EndTry

Catch{

Write-Error $PSItem

}#EndCatch

}#PROCESS

END{Write-Verbose "Ending $($MyInvocation.Mycommand)"

}#END

}#EndFunction

Function Check-Account () {

#Prüfung, ob der übergebene Account in der Systemusersammlung enthalten ist.

param (

[String]$ActualAccount, [String[]] $SystemAccounts

)

$myFound=$False

foreach ($Account in $SystemAccounts)

{

$myFound=($myFound -or ($ActualAccount.Contains($Account)))

if ($myFound) {Return $myFound}

}

Return $myFound

}

Function Check-FolderACL {[cmdletbinding()]

# Prüfen, ob die NTFS-Berechtigungen in Ordnung sind

Param(

[Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True)][ValidateNotNullorEmpty()][string[]]$Path, [string[]] $Domain ="NESASP", [string[]] $GroupPrefix = "RSY"

)#EndParam

BEGIN{Write-Verbose "Checking ACLs for $($MyInvocation.Mycommand)"

}#BEGIN

PROCESS{

# NTFS-Berechtigungen für das Verzeichnis ermitteln

$FolderACL=Get-FolderACL -Path $Path

Try{

$MyCounter=0

# Jede einzelne Berechtigung überprüfen

foreach ($ACL in $FolderACL)

{

# Berechtigung in Variablen parken

$ACLAccount=$ACL.Group.ToString()

$ACLAccesstype=$ACL.AccessType

$ACLRights=$ACL.Rights

$ACLPath=$ACL.Path

# Prüfung, ob der aktuelle Account in den SystemUsern enthalten ist

$FoundUser=Check-Account -ActualAccount $ACLAccount -SystemAccounts $SystemUser

# Prüfung, ob der aktuelle Account in den SystemUsern oder in den SystemAdmins enthalten ist

$Found=((Check-Account -ActualAccount $ACLAccount -SystemAccounts $SystemAdmins) -or $FoundUser)

# Meldung ausgeben, wenn Vollzugriff erlaubt ist und (es ein Domänen-Account oder die Systemuser sind)

if (($ACLRights -eq "FullControl") -and ($ACLAccesstype -eq "Allow") -and (($ACLAccount.contains("$Domain")) -or $FoundUser)) {

write-color "Der Account ","$ACLAccount"," hat auf dem Pfad ",$ACLPath," Vollzugriff" -Color White,yellow,white,cyan,red -LogFile $LogfilePath

$MyCounter+=1

$Global:PositiveMatch+=$ACL | Select-Object @{Name='Freigabe';Expression={$Freigabe_Name}},

@{Name='Pfad';Expression={$ACLPath}},

@{Name='Account';Expression={$ACLAccount}},

@{Name='Typ';Expression={"NTFS"}},

@{Name='Zugriff';Expression={$ACLAccesstype}},

@{Name='Rechte';Expression={$ACLRights}}

}

else {

# Meldung ausgeben, wenn der Account nicht zu den Systemaccounts oder zu den Standard-Ressourcengruppen der Domänen gehört

if (!($ACLAccount.Contains("$Domain\$GroupPrefix")) -and (!$Found)) {

write-color "Der Account ","$ACLAccount"," hat auf dem Pfad ",$ACLPath," spezielle Rechte: ","$ACLAccesstype/$ACLRights" -Color White,yellow,white,cyan,white,yellow -LogFile $LogfilePath

$MyCounter+=1

$Global:PositiveMatch+=$ACL | Select-Object @{Name='Freigabe';Expression={$Freigabe_Name}},

@{Name='Pfad';Expression={$ACLPath}},

@{Name='Account';Expression={$ACLAccount}},

@{Name='Typ';Expression={"NTFS"}},

@{Name='Zugriff';Expression={$ACLAccesstype}},

@{Name='Rechte';Expression={$ACLRights}}

}

Return $MyCounter

}#EndTry

Catch{

Write-Error $PSItem

}#EndCatch

}#PROCESS

END{Write-Verbose "Ending $($MyInvocation.Mycommand)"

}#END

}

function Set-EmailHead($FormattingOptions) {

$Head = "<style>" +

"BODY{background-color:white;font-family:$($FormattingOptions.FontFamily);font-size:$($FormattingOptions.FontSize)}" +

"TABLE{border-width: 1px;border-style: solid;border-color: black;border-collapse: collapse}" +

"TH{border-width: 1px;padding: 3px;border-style: solid;border-color: black;background-color:`"#00297A`";font-color:white}" +

"TD{border-width: 1px;padding-right: 2px;padding-left: 2px;padding-top: 0px;padding-bottom: 0px;border-style: solid;border-color: black;background-color:white}" +

"H2{font-family:$($FormattingOptions.FontHeadingFamily);font-size:$($FormattingOptions.FontHeadingSize)}" +

"P{font-family:$($FormattingOptions.FontFamily);font-size:$($FormattingOptions.FontSize)}" +

"</style>"

return $Head

}

function Set-EmailBody($TableData, $TableWelcomeMessage) {

$body = "$TableWelcomeMessage"

if ($($TableData | Measure-Object).Count -gt 0) {

$body += $TableData | ConvertTo-Html | Out-String

$body = $body -replace "FullControl", "FullControl"

$body = $body -replace "Full", "Full"

$body = $body -replace "Jeder", "Jeder"

$body = $body -replace "Everyone", "Everyone"

$body += ""

}

else {

$body += " No changes happend during that period."

}

return $body

}

function Set-EmailReportBranding($FormattingOptions) {

$Report = "<a style=`"text-decoration:none`" href=`"$($FormattingOptions.CompanyBranding.Link)`" class=`"clink logo-container`">" +

#"<img width=171 height=15 src=`"$($FormattingOptions.CompanyLogo)`" border=`"0`" class=`"company-logo`" alt=`"company-logo`">" +

"<img width=<fix> height=<fix> src=`"$($FormattingOptions.CompanyBranding.Logo)`" border=`"0`" class=`"company-logo`" alt=`"company-logo`">" +

"</a>"

if ($FormattingOptions.CompanyBranding.Width -ne "") {

$report = $report -replace "width=<fix>", "width=$($FormattingOptions.CompanyBranding.Width)"

}

else {

$report = $report -replace "width=<fix>", ""

}

if ($FormattingOptions.CompanyBranding.Height -ne "") {

$report = $report -replace "height=<fix>", "height=$($FormattingOptions.CompanyBranding.Height)"

}

else {

$report = $report -replace "height=<fix>", ""

}

return $Report

}

function Set-EmailReportDetails($FormattingOptions) {

$DateReport = get-date -Format "dd.MM.yyyy | hh:mm:ss"

# HTML Report settings

$Report = "" +

"Report Zeitpunkt: $DateReport Uhr " +

"Report ausgeführt von: $env:userdomain\$($env:username.toupper()) auf $($env:ComputerName.toUpper())" +

""

return $Report

}

##############################

# Main Procedure

##############################

#Alle Userfreigaben einlesen und zählen

$Ergebnis = Get-SMBshare | Where-Object {($_.Name -ne "C$") -and ($_.Name -ne "IPC$") -and ($_.Name -ne "ADMIN$") -and ($_.Name -ne "P$") }

$MaxCount= Measure-Object | %{$Ergebnis.Count}

# Gibt es keine Userfreigaben? Dann alles roger, ansonten im ELSE-Zweig abarbeiten

if ($MaxCount -eq 0)

{

Write-Color -Text "Keine Freigaben gefunden." -LogFile $LogfilePath -LinesBefore 1

}

else

{

Write-Color -Text "Es wurden ","$MaxCount Freigaben"," auf dem Rechner $PC gefunden." -Color white,Yellow,White -LogFile $LogfilePath -LinesBefore 1

# Gesamtzähler initialisieren

$TotalCounter=0

# Durch die Freigaben iterieren

foreach ($Freigabe in $Ergebnis)

{

# Einzelzähler zurücksetzen und Infos zur Freigabe in Variablen parken

$Counter=0

$Freigabe_Name = $Freigabe.Name

$SharePath = $Freigabe.Path

write-color "Die Freigabe ","$Freigabe_Name"," unter Pfad ","$SharePath"," wird geprüft." -Color white,Magenta,white,cyan,white -LogFile $LogfilePath -LinesBefore 1

$SMBAccounts = Get-SmbShareAccess -Name $Freigabe_Name

# Dann in die Rechte der Freigabe eintauchen und diese einzeln durch gehen

foreach ($SMBAccount in $SMBAccounts)

{

$Freigabe_Account = $SMBAccount.Accountname

$Freigabe_Access =$SMBAccount.AccessRight

$Freigabe_Accesstype = $SMBAccount.AccessControlType

# Ist der Account NICHT innerhalb der Namenskonvention oder hat er Vollzugriff,

# dann schlag Alarm

# Namenskonvention: Der Account muss aus der vorgegebenen Domäne sein und der Account soll mit dem Standgruppepräfix beginnen

# Beispiel: Domäne NESASP und es wird auf Standard-Ressourcengruppe geprüft, die mit RSY beginnen

if ((!($Freigabe_Account.contains("$Domain\$GroupPrefix")) -or ($Freigabe_Access -eq "Full")) ) {

$Counter+=1

# Vollzugriff separat melden

if (($Freigabe_Access -eq "Full") -and ($Freigabe_Accesstype -eq "Allow")) {

Write-Color -Text "Der Account ","$Freigabe_Account"," hat auf der Freigabe ","$Freigabe_Name"," Vollzugriff" -Color white,Yellow,white,magenta,red -LogFile $LogfilePath

$PositiveMatch+=$SMBAccount | Select-Object @{Name='Freigabe';Expression={$Freigabe_Name}},

@{Name='Pfad';Expression={$SharePath}},

@{Name='Account';Expression={$Freigabe_Account}},

@{Name='Typ';Expression={"SMB"}},

@{Name='Zugriff';Expression={$Freigabe_Accesstype}},

@{Name='Rechte';Expression={$Freigabe_Access}}

}

else {

Write-Color -Text "Der Account ","$Freigabe_Account"," hat auf der Freigabe ","$Freigabe_Name"," folgende Rechte: ","$Freigabe_Accesstype/$Freigabe_Access" -Color white,Yellow,white,magenta,white,yellow -LogFile $LogfilePath

$PositiveMatch+=$SMBAccount | Select-Object @{Name='Freigabe';Expression={$Freigabe_Name}},

@{Name='Pfad';Expression={$SharePath}},

@{Name='Account';Expression={$Freigabe_Account}},

@{Name='Typ';Expression={"SMB"}},

@{Name='Zugriff';Expression={$Freigabe_Accesstype}},

@{Name='Rechte';Expression={$Freigabe_Access}}

}

# Handelt es sich um eine Dateifreigabe?

# Dann prüfe die NTFS-Berechtigungen, ansonsten Info, das es sich um KEINE Dateifreigabe handelt

if (($SharePath.Contains(":"))){

$Counter+=Check-FolderACL -Path $SharePath -Domain $Domain -GroupPrefix $GroupPrefix

}

else {

Write-Color "Der Pfad der Freigabe liegt nicht auf dem Dateisystem." -Color Yellow

}

# War bei dieser Freigabe alles in Ordnung?

if ($Counter -eq 0) {

write-color "Auf Freigabe ","$Freigabe_Name"," ist alles in Ordnung." -Color Green,magenta,green -LogFile $LogfilePath

}

# Gesamtzähler und Einzelzähler erhöhen

$TotalCounter+=$Counter

}

# War insgesamt alles in Ordnung?

if ($TotalCounter -eq 0) {

Write-Color -Text "Es wurden keine Auffälligkeiten gefunden!" -Color green -LogFile $LogfilePath

}

else {

# Falls was gefunden wurde, dann Info und per Mail benachrichtigen

Write-Color -Text "Es wurden ","$TotalCounter Auffälligkeiten ","gefunden!" -Color white,red,white -LogFile $LogfilePath -LinesBefore 1

$EmailBody = Set-EmailHead -FormattingOptions $FormattingParameters

$EmailBody += Set-EmailReportBranding -FormattingOptions $FormattingParameters

$EmailBody += Set-EmailReportDetails -FormattingOptions $FormattingParameters

$EmailBody += Set-Emailbody -TableData $PositiveMatch -TableWelcomeMessage "Auffälligkeiten auf dem Server $PC"

$Encoding=$EmailParameters.EmailEncoding

Send-MailMessage -to $EmailParameters.EmailTo -Subject $EmailParameters.EmailSubject -From $EmailParameters.EmailFrom -Attachments "$LogfilePath" -Body $EmailBody -SmtpServer $EmailParameters.EmailServer -encoding ([System.Text.Encoding]::$Encoding) -BodyAsHtml -Port $EmailParameters.EmailServerPort

}

GUI for Scripts with Powershell

If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))
{
  # Relaunch as an elevated process:
  Start-Process powershell.exe "-File",('"{0}"' -f $MyInvocation.MyCommand.Path) -Verb RunAs
  exit
}


function Get-ScriptDirectory {
    if ($psise) {
        Split-Path $psise.CurrentFile.FullPath
    }
    else {
        $global:PSScriptRoot
    }
}

$CurrentFilename = $MyInvocation.MyCommand.Name

$Location = Get-ScriptDirectory
set-location $Location

$checkboxcount = 0
#Genrates main form
function GenerateForm {
#loading windows forms assembly
    [reflection.assembly]::loadwithpartialname("System.Windows.Forms") | Out-Null 
    [reflection.assembly]::loadwithpartialname("System.Drawing") | Out-Null

#creating control objects

    $form1 = New-Object System.Windows.Forms.Form

    $InitialFormWindowState = New-Object System.Windows.Forms.FormWindowState

#region Generated Form Code

    $form1.Text = "GUI PSScripts"

    $form1.Name = "form1"

    $form1.AutoScroll="true"

    $form1.DataBindings.DefaultDataSourceUpdateMode = 0

    $System_Drawing_Size = New-Object System.Drawing.Size

    $System_Drawing_Size.Width = 400

    $System_Drawing_Size.Height = 236

    $form1.ClientSize = $System_Drawing_Size
    
    $form1.AutoSize = $true


# Call function to generate on the fly checkboxes

    function GenerateCheckboxes 
    {


        $Label = New-Object System.Windows.Forms.Label
        $Label.Location = New-Object System.Drawing.Size(10,10)
        $Label.Text = "Do Nothing"
        $Label.AutoSize = $True
        $Label.Name = "L_Display"
        $form1.Controls.Add($Label)

#Read Filename from Folder and exclude the GUI File

        $Output = ""
        $Firstline = 0
        foreach($line in (Get-ChildItem -filter "*.ps1").name)
        {
            if( -not ($line.ToString() -eq $CurrentFilename))
            {
                if($Firstline -eq 0)
                {
                     $Output = $line
                     $Firstline = 1
                }
                else
                {
                    $Output = $Output + "`r`n"  + $line
                }
            }
        }
        Set-Content -path "Script4Gui.txt" -value $Output
        $CheckBoxLabels=Get-Content "Script4Gui.txt"

# Keep track of number of checkboxes

        $CheckBoxCounter = 1

#looping to create checkboxes based on the CheckBoxLabels array

 $StartY = 35
        $CheckBoxes = foreach($Label in $CheckBoxLabels) 
        {
            

            $CheckBox = New-Object System.Windows.Forms.CheckBox

            $CheckBox.UseVisualStyleBackColor = $True

            $System_Drawing_Size = New-Object System.Drawing.Size

            $System_Drawing_Size.Width = 104

            $System_Drawing_Size.Height = 30

            $CheckBox.Size = $System_Drawing_Size

            $CheckBox.TabIndex = 2

# Assign text based on the input

            $CheckBox.Text = $Label

            $System_Drawing_Point = New-Object System.Drawing.Point

            $System_Drawing_Point.X = 27

# Make sure to vertically space them dynamically, counter comes in handy
            
            #$System_Drawing_Point.Y = 50 + (($CheckBoxCounter - 1) * 31) + $GetDiffTop
            $System_Drawing_Point.Y = $StartY + 35 + $GetDiffTop
            
            $CheckBox.Location = $System_Drawing_Point

            $CheckBox.DataBindings.DefaultDataSourceUpdateMode = 0

# Give it a unique name based on our counter

            $CheckBox.Name = $Label
            $CheckBox.AutoSize = $true 
# Add it to the form

            $form1.Controls.Add($CheckBox)
            $startY = $checkbox.top
            $GetDiffTop = 0
# return object ref to array

            $CheckBox

# increment our counter
            $checkboxcount = $CheckBoxCounter
           $CheckBoxCounter++

            $GetScript = ".\" + $Label
            $ResultCommand = (Get-Command $GetScript).parameterSets[0].parameters | select name,ParameterType
            
            if ($ResultCommand.length -gt 0)
            {
             $GetTOP = $CheckBox.top
             $CheckBoxCounterParam = 0
             foreach ($Param in $ResultCommand)
             {
                    
                    
                    $CheckBoxParam = New-Object System.Windows.Forms.CheckBox

                    $CheckBoxParam.UseVisualStyleBackColor = $True

                    $System_Drawing_Size = New-Object System.Drawing.Size

                    $System_Drawing_Size.Width = 104

                    $System_Drawing_Size.Height = 30

                    $CheckBoxParam.Size = $System_Drawing_Size

                    $CheckBoxParam.TabIndex = 2

                    # Assign text based on the input

                    $CheckBoxParam.Text = $Param.name

                    $System_Drawing_Point = New-Object System.Drawing.Point

                    $System_Drawing_Point.X = 45

                    # Make sure to vertically space them dynamically, counter comes in handy
    
                    $System_Drawing_Point.Y = $checkbox.top + 65 + (($CheckBoxCounterParam - 1) * 31)
                    
                    
                    $CheckBoxParam.Location = $System_Drawing_Point
                    $CheckBoxParam.DataBindings.DefaultDataSourceUpdateMode = 0

                    # Give it a unique name based on our counter

                    $CheckBoxParam.Name = $Checkbox.name + '_' + $Param.name
                    $CheckBoxParam.AutoSize = $true
                    $CheckBoxParam.Enabled = $false
                     # Add it to the form

                    $form1.Controls.Add($CheckBoxParam)
                                      
                    if(-not ($Param.ParameterType.tostring() -eq "System.Management.Automation.SwitchParameter"))
                    {
                        


                        $LabelParam = New-Object System.Windows.Forms.Label
                        $System_Drawing_Point_LBL = New-Object System.Drawing.Point
                        $System_Drawing_Point_LBL.X = $CheckBoxParam.Left + $CheckBoxParam.Width
                        $System_Drawing_Point_LBL.Y = $CheckBoxParam.Top
                        $LabelParam.Location = $System_Drawing_Point_LBL
                        $LabelParam.Text = "Type: " + $Param.ParameterType.tostring()
                        $LabelParam.AutoSize = $true
                        $LabelParam.ForeColor = "Gray"
                        $form1.Controls.Add($LabelParam)

                        $TextBoxParam = New-Object System.Windows.Forms.TextBox
                        $TextBoxParam.name = $CheckBoxParam.name + "_TXT"
                        $System_Drawing_Point_TXT = New-Object System.Drawing.Point
                        $System_Drawing_Point_TXT.X = $LabelParam.Left + $LabelParam.Width + 20
                        $System_Drawing_Point_TXT.Y = $CheckBoxParam.Top -3
                        $TextBoxParam.Location = $System_Drawing_Point_TXT
                        $TextBoxParam.Width = 300
                        $textBoxParam.Font = New-Object System.Drawing.Font("Arial", 12)
                        $TextBoxParam.Enabled = $false
                        $TextBoxParam.BorderStyle = "None"
                        
                        if ($Param.name -eq "ErrorAction") {$textBoxParam.Text = "SilentlyContinue"}
                        
                        $TextBoxParam.Add_TextChanged(
                        {
                            $a = $this.name -replace("_txt","")
                            $getCheckbox = $Form1.Controls | where-Object {$_.Name -like $a}
                            if (-not ($getCheckbox.Checked))
                            {
                                $getCheckbox.Checked = $true
                            }
                        }
                        )
                                            
                        $form1.Controls.Add($TextBoxParam)
                    }
                    
                     
                    # return object ref to array

                    $CheckBoxParam

                    $CheckBoxCounterParam++           
             
             }
             
             $GetTopAfter = $CheckBoxParam.Top
             $GetDiffTop = $GetTopAfter - $GetTOP

             $CheckBox.Add_CheckStateChanged(
                        {
                            
                            $Name = $this.name
                            
                            $getOptions = $Form1.Controls | where-Object {$_.Name -like $Name+ "_*"}
                            if ($this.Checked)
                            {                               
                                foreach ($CO in $getOptions)
                                {
                                    $CO.Enabled = $True
                                }
                            }
                            else
                            {
                                foreach ($CO in $getOptions)
                                {
                                    $CO.Enabled = $False
                                }
                            }

                        }
                    )


            }

            $CheckBox.add_MouseHover(
                {
                        $tooltip1 = New-Object System.Windows.Forms.ToolTip
                        $Path = ".\" +$this.name
                        $tooltip1.SetToolTip($this,(get-help $Path)) #+"Blubber"+"`nbla")
                })

            $LabelCheck = New-Object System.Windows.Forms.Label
            $LabelCheck.name = $CheckBox.name + "_LBL"
            $System_Drawing_Point_LBL = New-Object System.Drawing.Point
            $System_Drawing_Point_LBL.X = $CheckBox.Left + $CheckBox.Width + 20
            $System_Drawing_Point_LBL.Y = $CheckBox.Top + 3
            $LabelCheck.Location = $System_Drawing_Point_LBL
            $LabelCheck.Width = 90
            $LabelCheck.ForeColor = "Gray"
            $LabelCheck.Font = New-Object System.Drawing.Font("Arial", 7, [System.Drawing.FontStyle]::Italic)
            $LabelCheck.Text = " [< Paramter >] "
           
            $form1.Controls.Add($LabelCheck)


            $TextBoxCheck = New-Object System.Windows.Forms.TextBox
            $TextBoxCheck.name = $CheckBox.name + "-TXT"
            $System_Drawing_Point_TXT = New-Object System.Drawing.Point
            $System_Drawing_Point_TXT.X = $LabelCheck.Left + $LabelCheck.Width + 20
            $System_Drawing_Point_TXT.Y = $CheckBox.Top -3
            $TextBoxCheck.Location = $System_Drawing_Point_TXT
            $TextBoxCheck.Width = 400 #100
            $TextBoxCheck.Font = New-Object System.Drawing.Font("Arial", 12)
            $TextBoxCheck.BorderStyle = "None"
            #$TextBoxCheck.Enabled = $false
            $form1.Controls.Add($TextBoxCheck)

        }#End Loop
        

        $windowButton = New-Object System.Windows.Forms.Button
        $System_Drawing_Point_Button = New-Object System.Drawing.Point
        $System_Drawing_Point_Button.Y = $form1.Top + 35
        $System_Drawing_Point_Button.X = $form1.Width - 20
        $windowButton.Location = $System_Drawing_Point_Button 

        $windowButton.Text = "Go"
        
        $windowButton.Add_Click(
        {
            $getLoopAction = (Get-Content .\Script4Gui.txt) -split "`r`n" # [Environment]::NewLine
            
            $getLabel = $Form1.Controls | Where-Object {$_.Name -like "L_Display"} 
            
            
            foreach($C in $getLoopAction){
                
                $getObject = $Form1.Controls | Where-Object {$_.Name -like "$C"} 



                if($getObject.checked)
                {
        

                        $Script = ".\" + $C
                                       $ResultCommand = (Get-Command $Script).parameterSets[0].parameters.name
                        
                        if ($ResultCommand.length -gt 0)
                        {
                            foreach ($ParamCheckbox in $ResultCommand)
                            {
                                
                                $GetObjectParamCheckbox = $Form1.Controls | Where-Object {$_.Name -like "$C" + "_" + "$ParamCheckbox"} 
                                $GetObjectParamCheckbox_TXT = $Form1.Controls | Where-Object {$_.Name -like "$C" + "_" + "$ParamCheckbox" + "_TXT"} 
                                
                                if($GetObjectParamCheckbox.checked)
                                {
                                    if (-not ([string]::IsNullOrEmpty($GetObjectParamCheckbox_TXT)))
                                    {
                                        $Script = $Script + " -" + $ParamCheckbox + " " + $GetObjectParamCheckbox_TXT.text
                                    }
                                    else
                                    {
                                        $Script = $Script + " -" + $ParamCheckbox 
                                    }

                                }
                                $GetObjectParamCheckbox.checked = $False
                            }
                        }
                        $GetObjectCheckbox_TXT = $Form1.Controls | Where-Object {$_.Name -like "$C" + "-TXT"}
                        $Script = $Script + " " + $GetObjectCheckbox_TXT.text

                        write-host "Starte Script:"$Script
                        $getLabel.Text = "Starte Script:" + $Script
                        
                                       $Location = Get-ScriptDirectory
                                       set-location $Location
                        $Result= Invoke-Expression $Script
                                       #write-host $Result.toString().Substring(0,$Result.Length)
                                       if (-not ([string]::IsNullOrEmpty($Result)))
                                       {
                                       
                                              if($Result.toString().Substring(0,7) -eq "System." -and $Result.length -lt 10)
                                              {
                                                    $Script = "powershell -ExecutionPolicy ByPass -File " + $Script
                                                    write-host "Starte Script:"$Script
                                                    $Result= Invoke-Expression $Script
                                                    
                                              }
                                              $Result | Format-Table | Out-String|% {Write-Host $_}
                                       }
                                       
                                       
                                       
                                 $getObject.checked = $false
                }
                
            }
            $getLabel.Text = "Do Nothing"
            write-host "`r`n`r`n`r`n Done :)" -ForegroundColor Green -BackgroundColor Black
           # $form1.Dispose()
        }
        )
        $form1.Controls.Add($windowButton)


        $windowClose = New-Object System.Windows.Forms.Button
        $System_Drawing_Point_Button_Close = New-Object System.Drawing.Point
        $System_Drawing_Point_Button_Close.Y = $windowButton.Top
        $System_Drawing_Point_Button_Close.X = $windowButton.Left - 75
        $windowClose.Location = $System_Drawing_Point_Button_Close 

        $windowClose.Text = "Close"
        
        $windowClose.Add_Click(
        {
             remove-item -path ".\Script4Gui.txt" 
             $form1.Dispose()
        }
        )
        $form1.Controls.Add($windowClose)
    }#End Function

    GenerateCheckboxes



        [void]$form1.ShowDialog()#| Out-Null
    
} #End Function


GenerateForm

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))

{

# Relaunch as an elevated process:

Start-Process powershell.exe "-File",('"{0}"' -f $MyInvocation.MyCommand.Path) -Verb RunAs

exit

}

function Get-ScriptDirectory {

if ($psise) {

Split-Path $psise.CurrentFile.FullPath

}

else {

$global:PSScriptRoot

}

$CurrentFilename = $MyInvocation.MyCommand.Name

$Location = Get-ScriptDirectory

set-location $Location

$checkboxcount = 0

#Genrates main form

function GenerateForm {

#loading windows forms assembly

[reflection.assembly]::loadwithpartialname("System.Windows.Forms") | Out-Null

[reflection.assembly]::loadwithpartialname("System.Drawing") | Out-Null

#creating control objects

$form1 = New-Object System.Windows.Forms.Form

$InitialFormWindowState = New-Object System.Windows.Forms.FormWindowState

#region Generated Form Code

$form1.Text = "GUI PSScripts"

$form1.Name = "form1"

$form1.AutoScroll="true"

$form1.DataBindings.DefaultDataSourceUpdateMode = 0

$System_Drawing_Size = New-Object System.Drawing.Size

$System_Drawing_Size.Width = 400

$System_Drawing_Size.Height = 236

$form1.ClientSize = $System_Drawing_Size

$form1.AutoSize = $true

# Call function to generate on the fly checkboxes

function GenerateCheckboxes

{

$Label = New-Object System.Windows.Forms.Label

$Label.Location = New-Object System.Drawing.Size(10,10)

$Label.Text = "Do Nothing"

$Label.AutoSize = $True

$Label.Name = "L_Display"

$form1.Controls.Add($Label)

#Read Filename from Folder and exclude the GUI File

$Output = ""

$Firstline = 0

foreach($line in (Get-ChildItem -filter "*.ps1").name)

{

if( -not ($line.ToString() -eq $CurrentFilename))

{

if($Firstline -eq 0)

{

$Output = $line

$Firstline = 1

}

else

{

$Output = $Output + "`r`n" + $line

}

Set-Content -path "Script4Gui.txt" -value $Output

$CheckBoxLabels=Get-Content "Script4Gui.txt"

# Keep track of number of checkboxes

$CheckBoxCounter = 1

#looping to create checkboxes based on the CheckBoxLabels array

$StartY = 35

$CheckBoxes = foreach($Label in $CheckBoxLabels)

{

$CheckBox = New-Object System.Windows.Forms.CheckBox

$CheckBox.UseVisualStyleBackColor = $True

$System_Drawing_Size = New-Object System.Drawing.Size

$System_Drawing_Size.Width = 104

$System_Drawing_Size.Height = 30

$CheckBox.Size = $System_Drawing_Size

$CheckBox.TabIndex = 2

# Assign text based on the input

$CheckBox.Text = $Label

$System_Drawing_Point = New-Object System.Drawing.Point

$System_Drawing_Point.X = 27

# Make sure to vertically space them dynamically, counter comes in handy

#$System_Drawing_Point.Y = 50 + (($CheckBoxCounter - 1) * 31) + $GetDiffTop

$System_Drawing_Point.Y = $StartY + 35 + $GetDiffTop

$CheckBox.Location = $System_Drawing_Point

$CheckBox.DataBindings.DefaultDataSourceUpdateMode = 0

# Give it a unique name based on our counter

$CheckBox.Name = $Label

$CheckBox.AutoSize = $true

# Add it to the form

$form1.Controls.Add($CheckBox)

$startY = $checkbox.top

$GetDiffTop = 0

# return object ref to array

$CheckBox

# increment our counter

$checkboxcount = $CheckBoxCounter

$CheckBoxCounter++

$GetScript = ".\" + $Label

$ResultCommand = (Get-Command $GetScript).parameterSets[0].parameters | select name,ParameterType

if ($ResultCommand.length -gt 0)

{

$GetTOP = $CheckBox.top

$CheckBoxCounterParam = 0

foreach ($Param in $ResultCommand)

{

$CheckBoxParam = New-Object System.Windows.Forms.CheckBox

$CheckBoxParam.UseVisualStyleBackColor = $True

$System_Drawing_Size = New-Object System.Drawing.Size

$System_Drawing_Size.Width = 104

$System_Drawing_Size.Height = 30

$CheckBoxParam.Size = $System_Drawing_Size

$CheckBoxParam.TabIndex = 2

# Assign text based on the input

$CheckBoxParam.Text = $Param.name

$System_Drawing_Point = New-Object System.Drawing.Point

$System_Drawing_Point.X = 45

# Make sure to vertically space them dynamically, counter comes in handy

$System_Drawing_Point.Y = $checkbox.top + 65 + (($CheckBoxCounterParam - 1) * 31)

$CheckBoxParam.Location = $System_Drawing_Point

$CheckBoxParam.DataBindings.DefaultDataSourceUpdateMode = 0

# Give it a unique name based on our counter

$CheckBoxParam.Name = $Checkbox.name + '_' + $Param.name

$CheckBoxParam.AutoSize = $true

$CheckBoxParam.Enabled = $false

# Add it to the form

$form1.Controls.Add($CheckBoxParam)

if(-not ($Param.ParameterType.tostring() -eq "System.Management.Automation.SwitchParameter"))

{

$LabelParam = New-Object System.Windows.Forms.Label

$System_Drawing_Point_LBL = New-Object System.Drawing.Point

$System_Drawing_Point_LBL.X = $CheckBoxParam.Left + $CheckBoxParam.Width

$System_Drawing_Point_LBL.Y = $CheckBoxParam.Top

$LabelParam.Location = $System_Drawing_Point_LBL

$LabelParam.Text = "Type: " + $Param.ParameterType.tostring()

$LabelParam.AutoSize = $true

$LabelParam.ForeColor = "Gray"

$form1.Controls.Add($LabelParam)

$TextBoxParam = New-Object System.Windows.Forms.TextBox

$TextBoxParam.name = $CheckBoxParam.name + "_TXT"

$System_Drawing_Point_TXT = New-Object System.Drawing.Point

$System_Drawing_Point_TXT.X = $LabelParam.Left + $LabelParam.Width + 20

$System_Drawing_Point_TXT.Y = $CheckBoxParam.Top -3

$TextBoxParam.Location = $System_Drawing_Point_TXT

$TextBoxParam.Width = 300

$textBoxParam.Font = New-Object System.Drawing.Font("Arial", 12)

$TextBoxParam.Enabled = $false

$TextBoxParam.BorderStyle = "None"

if ($Param.name -eq "ErrorAction") {$textBoxParam.Text = "SilentlyContinue"}

$TextBoxParam.Add_TextChanged(

{

$a = $this.name -replace("_txt","")

$getCheckbox = $Form1.Controls | where-Object {$_.Name -like $a}

if (-not ($getCheckbox.Checked))

{

$getCheckbox.Checked = $true

}

)

$form1.Controls.Add($TextBoxParam)

}

# return object ref to array

$CheckBoxParam

$CheckBoxCounterParam++

}

$GetTopAfter = $CheckBoxParam.Top

$GetDiffTop = $GetTopAfter - $GetTOP

$CheckBox.Add_CheckStateChanged(

{

$Name = $this.name

$getOptions = $Form1.Controls | where-Object {$_.Name -like $Name+ "_*"}

if ($this.Checked)

{

foreach ($CO in $getOptions)

{

$CO.Enabled = $True

}

else

{

foreach ($CO in $getOptions)

{

$CO.Enabled = $False

}

)

}

$CheckBox.add_MouseHover(

{

$tooltip1 = New-Object System.Windows.Forms.ToolTip

$Path = ".\" +$this.name

$tooltip1.SetToolTip($this,(get-help $Path)) #+"Blubber"+"`nbla")

})

$LabelCheck = New-Object System.Windows.Forms.Label

$LabelCheck.name = $CheckBox.name + "_LBL"

$System_Drawing_Point_LBL = New-Object System.Drawing.Point

$System_Drawing_Point_LBL.X = $CheckBox.Left + $CheckBox.Width + 20

$System_Drawing_Point_LBL.Y = $CheckBox.Top + 3

$LabelCheck.Location = $System_Drawing_Point_LBL

$LabelCheck.Width = 90

$LabelCheck.ForeColor = "Gray"

$LabelCheck.Font = New-Object System.Drawing.Font("Arial", 7, [System.Drawing.FontStyle]::Italic)

$LabelCheck.Text = " [< Paramter >] "

$form1.Controls.Add($LabelCheck)

$TextBoxCheck = New-Object System.Windows.Forms.TextBox

$TextBoxCheck.name = $CheckBox.name + "-TXT"

$System_Drawing_Point_TXT = New-Object System.Drawing.Point

$System_Drawing_Point_TXT.X = $LabelCheck.Left + $LabelCheck.Width + 20

$System_Drawing_Point_TXT.Y = $CheckBox.Top -3

$TextBoxCheck.Location = $System_Drawing_Point_TXT

$TextBoxCheck.Width = 400 #100

$TextBoxCheck.Font = New-Object System.Drawing.Font("Arial", 12)

$TextBoxCheck.BorderStyle = "None"

#$TextBoxCheck.Enabled = $false

$form1.Controls.Add($TextBoxCheck)

}#End Loop

$windowButton = New-Object System.Windows.Forms.Button

$System_Drawing_Point_Button = New-Object System.Drawing.Point

$System_Drawing_Point_Button.Y = $form1.Top + 35

$System_Drawing_Point_Button.X = $form1.Width - 20

$windowButton.Location = $System_Drawing_Point_Button

$windowButton.Text = "Go"

$windowButton.Add_Click(

{

$getLoopAction = (Get-Content .\Script4Gui.txt) -split "`r`n" # [Environment]::NewLine

$getLabel = $Form1.Controls | Where-Object {$_.Name -like "L_Display"}

foreach($C in $getLoopAction){

$getObject = $Form1.Controls | Where-Object {$_.Name -like "$C"}

if($getObject.checked)

{

$Script = ".\" + $C

$ResultCommand = (Get-Command $Script).parameterSets[0].parameters.name

if ($ResultCommand.length -gt 0)

{

foreach ($ParamCheckbox in $ResultCommand)

{

$GetObjectParamCheckbox = $Form1.Controls | Where-Object {$_.Name -like "$C" + "_" + "$ParamCheckbox"}

$GetObjectParamCheckbox_TXT = $Form1.Controls | Where-Object {$_.Name -like "$C" + "_" + "$ParamCheckbox" + "_TXT"}

if($GetObjectParamCheckbox.checked)

{

if (-not ([string]::IsNullOrEmpty($GetObjectParamCheckbox_TXT)))

{

$Script = $Script + " -" + $ParamCheckbox + " " + $GetObjectParamCheckbox_TXT.text

}

else

{

$Script = $Script + " -" + $ParamCheckbox

}

$GetObjectParamCheckbox.checked = $False

}

$GetObjectCheckbox_TXT = $Form1.Controls | Where-Object {$_.Name -like "$C" + "-TXT"}

$Script = $Script + " " + $GetObjectCheckbox_TXT.text

write-host "Starte Script:"$Script

$getLabel.Text = "Starte Script:" + $Script

$Location = Get-ScriptDirectory

set-location $Location

$Result= Invoke-Expression $Script

#write-host $Result.toString().Substring(0,$Result.Length)

if (-not ([string]::IsNullOrEmpty($Result)))

{

if($Result.toString().Substring(0,7) -eq "System." -and $Result.length -lt 10)

{

$Script = "powershell -ExecutionPolicy ByPass -File " + $Script

write-host "Starte Script:"$Script

$Result= Invoke-Expression $Script

}

$Result | Format-Table | Out-String|% {Write-Host $_}

}

$getObject.checked = $false

}

$getLabel.Text = "Do Nothing"

write-host "`r`n`r`n`r`n Done :)" -ForegroundColor Green -BackgroundColor Black

# $form1.Dispose()

}

)

$form1.Controls.Add($windowButton)

$windowClose = New-Object System.Windows.Forms.Button

$System_Drawing_Point_Button_Close = New-Object System.Drawing.Point

$System_Drawing_Point_Button_Close.Y = $windowButton.Top

$System_Drawing_Point_Button_Close.X = $windowButton.Left - 75

$windowClose.Location = $System_Drawing_Point_Button_Close

$windowClose.Text = "Close"

$windowClose.Add_Click(

{

remove-item -path ".\Script4Gui.txt"

$form1.Dispose()

}

)

$form1.Controls.Add($windowClose)

}#End Function

GenerateCheckboxes

[void]$form1.ShowDialog()#| Out-Null

} #End Function

GenerateForm

Password Expire and Last Logon

param(
&#91;switch]$Showmode
)
#Showmode did not set anything


#OU from User to set
$OUName = "OU=OU-Test,OU=OU-04-User"

#Alternativ via Group
#$targetGroup = "GroupName"


#######################################
#Nothing to change, all Scriptcode works alone, except the Group Selection of Users want to use 
######################################

#Check if AD Module is installed, if not -> install it
$srv=Get-WindowsFeature *RSAT-AD-PowerShell*
if ($srv.Installed)
{
}
else
{
    Add-WindowsFeature RSAT-AD-PowerShell 
}

#Load AD Module
Import-Module activedirectory

#Get the Root Domain like "DC=Domain,DC=Local"
$RootDomain = (Get-ADDomain -Current LocalComputer).ComputersContainer.tostring().replace("CN=Computers,","")

#OU
$targetOU = "$OUName,$RootDomain"
$targetOU
$users = get-aduser -searchbase $targetOU -filter { passwordNeverExpires -eq $false -and pwdLastSet -gt 0 } -properties passwordLastSet

#Alternativ via Group
#$targetGroup = "GroupName"
#$users = Get-ADGroupMember -recursive $targetGroup | get-aduser -Properties passwordneverexpires,passwordlastset | Where-Object { $_.passwordNeverExpires -eq $false -and $_.passwordLastSet }

foreach ($user in $users) {
    $outObject = new-object -typename psobject
    $outobject | Add-member -MemberType NoteProperty -Name distinguishedName -Value $user.distinguishedname
    $outobject | Add-Member -MemberType NoteProperty -Name OldPasswordLastSet -value $user.passwordlastset
    if (-not($Showmode))
        {
            set-aduser $user -ChangePasswordAtLogon:$true
            set-aduser $user -ChangePasswordAtLogon:$false 
        }
    $outobject | Add-Member -MemberType NoteProperty -Name NewPasswordLastSet -value $(get-aduser $user -Properties passwordlastset).passwordlastset
    $outobject | Add-Member -MemberType NoteProperty -Name LastLogonDate -Value (Get-ADUser $user -Properties lastlogonDate).lastlogonDate
    $outObject
}

param(

[switch]$Showmode

)

#Showmode did not set anything

#OU from User to set

$OUName = "OU=OU-Test,OU=OU-04-User"

#Alternativ via Group

#$targetGroup = "GroupName"

#######################################

#Nothing to change, all Scriptcode works alone, except the Group Selection of Users want to use

######################################

#Check if AD Module is installed, if not -> install it

$srv=Get-WindowsFeature *RSAT-AD-PowerShell*

if ($srv.Installed)

{

}

else

{

Add-WindowsFeature RSAT-AD-PowerShell

}

#Load AD Module

Import-Module activedirectory

#Get the Root Domain like "DC=Domain,DC=Local"

$RootDomain = (Get-ADDomain -Current LocalComputer).ComputersContainer.tostring().replace("CN=Computers,","")

#OU

$targetOU = "$OUName,$RootDomain"

$targetOU

$users = get-aduser -searchbase $targetOU -filter { passwordNeverExpires -eq $false -and pwdLastSet -gt 0 } -properties passwordLastSet

#Alternativ via Group

#$targetGroup = "GroupName"

#$users = Get-ADGroupMember -recursive $targetGroup | get-aduser -Properties passwordneverexpires,passwordlastset | Where-Object { $_.passwordNeverExpires -eq $false -and $_.passwordLastSet }

foreach ($user in $users) {

$outObject = new-object -typename psobject

$outobject | Add-member -MemberType NoteProperty -Name distinguishedName -Value $user.distinguishedname

$outobject | Add-Member -MemberType NoteProperty -Name OldPasswordLastSet -value $user.passwordlastset

if (-not($Showmode))

{

set-aduser $user -ChangePasswordAtLogon:$true

set-aduser $user -ChangePasswordAtLogon:$false

}

$outobject | Add-Member -MemberType NoteProperty -Name NewPasswordLastSet -value $(get-aduser $user -Properties passwordlastset).passwordlastset

$outobject | Add-Member -MemberType NoteProperty -Name LastLogonDate -Value (Get-ADUser $user -Properties lastlogonDate).lastlogonDate

$outObject

}

Get Detail Eventlogs 2 Textfile

param(
[Parameter(Mandatory=$true)][int]$ShowLast_X_Days,
[string]$LogPath,
[switch]$ALLLogsWithoutSecurity,
[switch]$ALLPossibleLogs,
[string]$Searchvalue,
[switch]$GetLogonEvent,
[switch]$GetLogOFFEvent,
[switch]$GetLogFailEvent,
[switch]$APPSYSALLInfo,
[switch]$SetLocalSECAuditPolicy,
[switch]$DisableLocalSECAuditPolicy,
[string]$Computer,
[switch]$ExpandLogSize
)


#Example:
#.\GetDetailEventlogs.ps1 -ShowLast_X_Days 2 -LogPath C:\___Eventlogs\02122020 -ALLLogsWithoutSecurity -ALLPossibleLogs



if (-not (Test-Path -Path $LogPath))
{ 
            
    write-host "Create Path"$LogPath -ForegroundColor Green
    $ResultCreatePath = New-Item -ItemType "directory" -Path $LogPath
}

write-host "Please wait..." -ForegroundColor Yellow
if(-not ($Computer.Length -gt 0)) {$Computer = $env:COMPUTERNAME}

$LogPreffix = "___MLI_" + $Computer + "_"


if($ShowLast_X_Days -gt 0){$ShowLast_X_Days = $ShowLast_X_Days * (-1)}
if ([string]::IsNullOrEmpty($Searchvalue)) {$Searchvalue = ""}
if ($LogPath -gt 0)
{
    if (-not ($LogPath.Substring($LogPath.Length-1) -eq "\")) {$LogPath = $LogPath + "\"}
}
$Entrytype = "Error,Warning"
if ($ALLLogsWithoutSecurity) {$ALLPossibleLogs = $true}


if($ExpandLogSize)
{
    write-host "Change Logfile Size" -ForegroundColor Yellow
    $b = Get-EventLog -list |?{$_.Entries -ne 0}
    
    foreach ($Logview in $b)
    {  

        Limit-Eventlog -Logname $Logview.log -MaximumSize 500MB -OverflowAction OverwriteAsNeeded
        write-host "Set"$Logview.log"to 500MB" -ForegroundColor Yellow
    }
}

if ($ALLPossibleLogs)
{

    $a = Get-EventLog -list |?{$_.Entries -ne 0}

    foreach ($Logview in $a)
    {  
        if($ExpandLogSize)
        {
            Limit-Eventlog -Logname $Logview.log -MaximumSize 500MB -OverflowAction OverwriteAsNeeded
        }

        if(($Logview.log -eq "System" -or $Logview.log -eq "Application") -and $APPSYSALLInfo -eq $false)
        {
            $log = $LogPath + $LogPreffix + "ALLEventlog_EW_" + $Logview.log + "_" + $Searchvalue + ".txt"
            if ($LogPath.Length -gt 0)
            {
                Get-Eventlog -LogName $Logview.log -EntryType Error,Warning -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl > $log
            }
            else
            {
                Get-Eventlog -LogName $Logview.log -EntryType Error,Warning -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer  | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl 
            }

        }
        else
        {
            if ($ALLLogsWithoutSecurity -eq $true -and $Logview.log -eq "Security")
            {
            
            }
            else
            {

                $log = $LogPath + $LogPreffix + "ALLEventlog_IEW_" + $Logview.log + "_" + $Searchvalue + ".txt"
                if ($LogPath.Length -gt 0)
                {
                    Get-Eventlog -LogName $Logview.log -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer  | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl > $log
                }
                else
                {
                    Get-Eventlog -LogName $Logview.log -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer  | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl 
                }
            }
        }

    }

}

if ($GetLogonEvent)
{
    if ($LogPath.Length -gt 0)
    {
        $log = $LogPath + $LogPreffix + "LogonReport_" + $Searchvalue + ".txt"
        Get-EventLog -LogName Security -InstanceId 4624 -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer -ErrorAction SilentlyContinue | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl > $log #| Where-Object Message -Match "Logon Type:            2" 
    }
    else
    {
        Get-EventLog -LogName Security -InstanceId 4624 -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer -ErrorAction SilentlyContinue | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl # Where-Object Message -Match "Logon Type:            2" |fl        
    }
}

if ($GetLogOFFEvent)
{
    if ($LogPath.Length -gt 0)
    {
        $log = $LogPath + $LogPreffix + "LogOFFReport_" + $Searchvalue + ".txt"
        Get-EventLog -LogName Security -InstanceId 4634 -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer -ErrorAction SilentlyContinue | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl > $log #| Where-Object Message -Match "Logon Type:                   3" |fl > $log
    }
    else
    {
        Get-EventLog -LogName Security -InstanceId 4634 -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer -ErrorAction SilentlyContinue | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl # Where-Object Message -Match "Logon Type:                  3" |fl        
    }
}
if ($GetLogFailEvent)
{
    if ($LogPath.Length -gt 0)
    {
        $log = $LogPath + $LogPreffix + "LogFailEvent" + $Searchvalue + ".txt"
        Get-EventLog -LogName Security -InstanceId 4625 -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer -ErrorAction SilentlyContinue | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl > $log #| Where-Object Message -Match "Logon Type:                   2" |fl > $log
    }
    else
    {
        Get-EventLog -LogName Security -InstanceId 4625 -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer -ErrorAction SilentlyContinue | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl # Where-Object Message -Match "Logon Type:                  2" |fl        
    }
}

if($SetLocalSECAuditPolicy)
{
    write-host "Before:" -ForegroundColor Yellow
    auditpol /get /Category:*

    auditpol /set /category:"System","Account Management","Account Logon","Logon/Logoff","Policy Change" /failure:enable /success:enable     

    auditpol /set /category:"DS Access","Object Access" /failure:enable

    write-host "After:" -ForegroundColor Yellow
    auditpol /get /Category:*

}

if($DisableLocalSECAuditPolicy)
{
    write-host "Before:" -ForegroundColor Yellow
    auditpol /get /Category:*

    auditpol /set /category:"System","Account Management","Account Logon","Logon/Logoff","Policy Change" /failure:disable /success:disable     

    auditpol /set /category:"DS Access","Object Access" /failure:disable

    write-host "After:" -ForegroundColor Yellow
    auditpol /get /Category:*

}

write-host "...done." -ForegroundColor Green

#  4624 -> erfolgreich angemeldet
#  4625 -> fehlerhafte Anmeldung
#  4771 -> nicht erfolgreiche Anmeldungen

#Event ID     Bedeutung
#4624   An account was successfully logged on
#4625   An account failed to login.
#4634   An account was logged off
#4719    Audit Policy Change
#4740   A User account was locked outa
#4767   A User account was unlocked
#4768   A Kerberos authentication ticket (TGT) was requested
#4769   A Kerberos service ticket was requested.
#4776   The domain controller attempted to validate the credentials für an account.
#4672   Special privileges assigned to new logon

#Logon Events Description  
#528    A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below.     
#529    Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password.   
#530    Logon failure. A logon attempt was made user account tried to log on outside of the allowed time.     
#531    Logon failure. A logon attempt was made using a disabled account. 
#532    Logon failure. A logon attempt was made using an expired account. 
#533    Logon failure. A logon attempt was made by a user who is not allowed to log on at this computer.      
#534    Logon failure. The user attempted to log on with a type that is not allowed.     
#535    Logon failure. The password for the specified account has expired.       
#536    Logon failure. The Net Logon service is not active. 
#537    Logon failure. The logon attempt failed for other reasons. 
             
#       Note   
             
#       In some cases, the reason for the logon failure may not be known. 
             
#538    The logoff process was completed for a user.  
#539    Logon failure. The account was locked out at the time the logon attempt was made.   
#540    A user successfully logged on to a network.   
#541    Main mode Internet Key Exchange (IKE) authentication was completed between the local computer and the listed peer identity (establishing a security association), or quick mode has established a data channel.    
#542    A data channel was terminated.   
#543    Main mode was terminated. 
             
#       Note   
             
#       This might occur as a result of the time limit on the security association expiring (the default is eight hours), policy changes, or peer termination. 
             
#544    Main mode authentication failed because the peer did not provide a valid certificate or the signature was not validated.      
#545    Main mode authentication failed because of a Kerberos failure or a password that is not valid.      
#546    IKE security association establishment failed because the peer sent a proposal that is not valid. A packet was received that contained data that is not valid.   
#547    A failure occurred during an IKE handshake.   
#548    Logon failure. The security ID (SID) from a trusted domain does not match the account domain SID of the client.   
#549    Logon failure. All SIDs corresponding to untrusted namespaces were filtered out during an authentication across forests.      
#550    Notification message that could indicate a possible denial-of-service attack.      
#551    A user initiated the logoff process.   
#552    A user successfully logged on to a computer using explicit credentials while already logged on as a different user.  
#682    A user has reconnected to a disconnected terminal server session. 
#683    A user disconnected a terminal server session without logging off.       
             
#       Note   
             
#       This event is generated when a user is connected to a terminal server session over the network. It appears on the terminal server.      
             
#Logon type   Logon title  Description
#2      Interactive  A user logged on to this computer.
#3      Network      A user or computer logged on to this computer from the network.
#4      Batch  Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention.
#5      Service      A service was started by the Service Control Manager.
#7      Unlock This workstation was unlocked.
#8      NetworkCleartext    A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext).
#9      NewCredentials      A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections.
#10     RemoteInteractive   A user logged on to this computer remotely using Terminal Services or Remote Desktop.
#11     CachedInteractive   A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials.

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

param(

[Parameter(Mandatory=$true)][int]$ShowLast_X_Days,

[string]$LogPath,

[switch]$ALLLogsWithoutSecurity,

[switch]$ALLPossibleLogs,

[string]$Searchvalue,

[switch]$GetLogonEvent,

[switch]$GetLogOFFEvent,

[switch]$GetLogFailEvent,

[switch]$APPSYSALLInfo,

[switch]$SetLocalSECAuditPolicy,

[switch]$DisableLocalSECAuditPolicy,

[string]$Computer,

[switch]$ExpandLogSize

)

#Example:

#.\GetDetailEventlogs.ps1 -ShowLast_X_Days 2 -LogPath C:\___Eventlogs\02122020 -ALLLogsWithoutSecurity -ALLPossibleLogs

if (-not (Test-Path -Path $LogPath))

{

write-host "Create Path"$LogPath -ForegroundColor Green

$ResultCreatePath = New-Item -ItemType "directory" -Path $LogPath

}

write-host "Please wait..." -ForegroundColor Yellow

if(-not ($Computer.Length -gt 0)) {$Computer = $env:COMPUTERNAME}

$LogPreffix = "___MLI_" + $Computer + "_"

if($ShowLast_X_Days -gt 0){$ShowLast_X_Days = $ShowLast_X_Days * (-1)}

if ([string]::IsNullOrEmpty($Searchvalue)) {$Searchvalue = ""}

if ($LogPath -gt 0)

{

if (-not ($LogPath.Substring($LogPath.Length-1) -eq "\")) {$LogPath = $LogPath + "\"}

}

$Entrytype = "Error,Warning"

if ($ALLLogsWithoutSecurity) {$ALLPossibleLogs = $true}

if($ExpandLogSize)

{

write-host "Change Logfile Size" -ForegroundColor Yellow

$b = Get-EventLog -list |?{$_.Entries -ne 0}

foreach ($Logview in $b)

{

Limit-Eventlog -Logname $Logview.log -MaximumSize 500MB -OverflowAction OverwriteAsNeeded

write-host "Set"$Logview.log"to 500MB" -ForegroundColor Yellow

}

if ($ALLPossibleLogs)

{

$a = Get-EventLog -list |?{$_.Entries -ne 0}

foreach ($Logview in $a)

{

if($ExpandLogSize)

{

Limit-Eventlog -Logname $Logview.log -MaximumSize 500MB -OverflowAction OverwriteAsNeeded

}

if(($Logview.log -eq "System" -or $Logview.log -eq "Application") -and $APPSYSALLInfo -eq $false)

{

$log = $LogPath + $LogPreffix + "ALLEventlog_EW_" + $Logview.log + "_" + $Searchvalue + ".txt"

if ($LogPath.Length -gt 0)

{

Get-Eventlog -LogName $Logview.log -EntryType Error,Warning -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl > $log

}

else

{

Get-Eventlog -LogName $Logview.log -EntryType Error,Warning -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl

}

else

{

if ($ALLLogsWithoutSecurity -eq $true -and $Logview.log -eq "Security")

{

}

else

{

$log = $LogPath + $LogPreffix + "ALLEventlog_IEW_" + $Logview.log + "_" + $Searchvalue + ".txt"

if ($LogPath.Length -gt 0)

{

Get-Eventlog -LogName $Logview.log -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl > $log

}

else

{

Get-Eventlog -LogName $Logview.log -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl

}

if ($GetLogonEvent)

{

if ($LogPath.Length -gt 0)

{

$log = $LogPath + $LogPreffix + "LogonReport_" + $Searchvalue + ".txt"

Get-EventLog -LogName Security -InstanceId 4624 -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer -ErrorAction SilentlyContinue | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl > $log #| Where-Object Message -Match "Logon Type: 2"

}

else

{

}

if ($GetLogOFFEvent)

{

if ($LogPath.Length -gt 0)

{

$log = $LogPath + $LogPreffix + "LogOFFReport_" + $Searchvalue + ".txt"

Get-EventLog -LogName Security -InstanceId 4634 -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer -ErrorAction SilentlyContinue | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl > $log #| Where-Object Message -Match "Logon Type: 3" |fl > $log

}

else

{

}

if ($GetLogFailEvent)

{

if ($LogPath.Length -gt 0)

{

$log = $LogPath + $LogPreffix + "LogFailEvent" + $Searchvalue + ".txt"

Get-EventLog -LogName Security -InstanceId 4625 -After (get-date).AddDays($ShowLast_X_Days) -ComputerName $Computer -ErrorAction SilentlyContinue | ?{$_.Message -like "*" + $Searchvalue + "*"} |fl > $log #| Where-Object Message -Match "Logon Type: 2" |fl > $log

}

else

{

}

if($SetLocalSECAuditPolicy)

{

write-host "Before:" -ForegroundColor Yellow

auditpol /get /Category:*

auditpol /set /category:"System","Account Management","Account Logon","Logon/Logoff","Policy Change" /failure:enable /success:enable

auditpol /set /category:"DS Access","Object Access" /failure:enable

write-host "After:" -ForegroundColor Yellow

auditpol /get /Category:*

}

if($DisableLocalSECAuditPolicy)

{

write-host "Before:" -ForegroundColor Yellow

auditpol /get /Category:*

auditpol /set /category:"System","Account Management","Account Logon","Logon/Logoff","Policy Change" /failure:disable /success:disable

auditpol /set /category:"DS Access","Object Access" /failure:disable

write-host "After:" -ForegroundColor Yellow

auditpol /get /Category:*

}

write-host "...done." -ForegroundColor Green

# 4624 -> erfolgreich angemeldet

# 4625 -> fehlerhafte Anmeldung

# 4771 -> nicht erfolgreiche Anmeldungen

#Event ID Bedeutung

#4624 An account was successfully logged on

#4625 An account failed to login.

#4634 An account was logged off

#4719 Audit Policy Change

#4740 A User account was locked outa

#4767 A User account was unlocked

#4768 A Kerberos authentication ticket (TGT) was requested

#4769 A Kerberos service ticket was requested.

#4776 The domain controller attempted to validate the credentials für an account.

#4672 Special privileges assigned to new logon

#Logon Events Description

#528 A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below.

#529 Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password.

#530 Logon failure. A logon attempt was made user account tried to log on outside of the allowed time.

#531 Logon failure. A logon attempt was made using a disabled account.

#532 Logon failure. A logon attempt was made using an expired account.

#533 Logon failure. A logon attempt was made by a user who is not allowed to log on at this computer.

#534 Logon failure. The user attempted to log on with a type that is not allowed.

#535 Logon failure. The password for the specified account has expired.

#536 Logon failure. The Net Logon service is not active.

#537 Logon failure. The logon attempt failed for other reasons.

# Note

# In some cases, the reason for the logon failure may not be known.

#538 The logoff process was completed for a user.

#539 Logon failure. The account was locked out at the time the logon attempt was made.

#540 A user successfully logged on to a network.

#541 Main mode Internet Key Exchange (IKE) authentication was completed between the local computer and the listed peer identity (establishing a security association), or quick mode has established a data channel.

#542 A data channel was terminated.

#543 Main mode was terminated.

# Note

# This might occur as a result of the time limit on the security association expiring (the default is eight hours), policy changes, or peer termination.

#544 Main mode authentication failed because the peer did not provide a valid certificate or the signature was not validated.

#545 Main mode authentication failed because of a Kerberos failure or a password that is not valid.

#546 IKE security association establishment failed because the peer sent a proposal that is not valid. A packet was received that contained data that is not valid.

#547 A failure occurred during an IKE handshake.

#548 Logon failure. The security ID (SID) from a trusted domain does not match the account domain SID of the client.

#549 Logon failure. All SIDs corresponding to untrusted namespaces were filtered out during an authentication across forests.

#550 Notification message that could indicate a possible denial-of-service attack.

#551 A user initiated the logoff process.

#552 A user successfully logged on to a computer using explicit credentials while already logged on as a different user.

#682 A user has reconnected to a disconnected terminal server session.

#683 A user disconnected a terminal server session without logging off.

# Note

# This event is generated when a user is connected to a terminal server session over the network. It appears on the terminal server.

#Logon type Logon title Description

#2 Interactive A user logged on to this computer.

#3 Network A user or computer logged on to this computer from the network.

#4 Batch Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention.

#5 Service A service was started by the Service Control Manager.

#7 Unlock This workstation was unlocked.

#8 NetworkCleartext A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext).

#9 NewCredentials A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections.

#10 RemoteInteractive A user logged on to this computer remotely using Terminal Services or Remote Desktop.

#11 CachedInteractive A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials.

InstallRootCertFromWebsite

# // first argument is mapped to $url
 param($url)
 &nbsp;
 [Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
 &nbsp;
 [System.Uri] $u = New-Object System.Uri($url)
 [Net.ServicePoint] $sp = [Net.ServicePointManager]::FindServicePoint($u);
 &nbsp;
 [System.Guid] $groupName = [System.Guid]::NewGuid()
 &nbsp;
 # // create a request
 [Net.HttpWebRequest] $req = [Net.WebRequest]::create($url)
 $req.Method = "GET"
 $req.Timeout = 600000 # = 10 minutes
 $req.ConnectionGroupName = $groupName
 &nbsp;
 # // Set if you need a username/password to access the resource
 #$req.Credentials = New-Object Net.NetworkCredential("username", "password");
 &nbsp;
 [Net.HttpWebResponse] $result = $req.GetResponse()
 &nbsp;
 $sp.CloseConnectionGroup($groupName)
 &nbsp;
 $fullPathIncFileName = $MyInvocation.MyCommand.Definition
 &nbsp;
 $currentScriptName = $MyInvocation.MyCommand.Name
 &nbsp;
 $currentExecutingPath = $fullPathIncFileName.Replace($currentScriptName, "")
 &nbsp;
 $outfilename = $currentExecutingPath + "Export.cer"
 &nbsp;
 [System.Byte[]] $data = $sp.Certificate.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert)
 [System.IO.File]::WriteAllBytes($outfilename, $data)
 Write-Host $outfilename
 &nbsp;
 Import-Certificate -FilePath $outfilename -CertStoreLocation 'Cert:\LocalMachine\Root' -Verbose
 &nbsp;
 &nbsp;
 #CertUtil -addStore Root $outfilename